Identity-based networking shows why “good enough” access is costly

At a glance

What this is: This is Tailscale’s analysis of a Forrester TEI study showing that identity-based networking can replace layered remote access controls while lowering operational overhead and breach exposure.

Why it matters: For IAM, PAM, and zero trust teams, the key point is that access design affects not just security posture but helpdesk load, developer friction, and the size of the blast radius.

By the numbers:

• The study models a 3,000-employee enterprise.
• Tailscale reports 213% ROI with payback in under six months.
• The study models a 70% reduction in exposure to breach costs for addressable attacks.

Context

Network access becomes expensive when organisations bolt controls onto a perimeter model and then spend years maintaining the layers around it. The article argues that the real cost is not only the network path itself but the operational work required to keep remote access usable, governed, and secure. That makes identity-based networking relevant to IAM and zero trust programmes because the access decision moves closer to the connection rather than living in a separate stack.

In this model, the identity of the user, device, or system becomes the enforcement point for access. That matters for teams managing human access, remote workforce connectivity, and non-human connections because it reduces the need for broad network reach with compensating controls. The article frames this as a simplification problem, not just a cost-reduction exercise.

The starting position described here is typical of mature enterprises that have accumulated VPNs, remote access tools, load balancers, and NAT layers over time.

Key questions

Q: How should teams implement identity-based networking without recreating VPN sprawl?

A: Start by making the access decision explicit for each session, then remove network-wide reach wherever a narrower resource path will do. The goal is not to replace one tunnel with another control plane, but to make identity, device posture, and destination policy the basis of access so broad implicit trust disappears.

Q: Why does broad remote access increase blast radius even when logins are authenticated?

A: Authentication proves an identity, not the scope of damage that identity can cause. If access is broad once the session is established, a compromised account or device can move farther than intended, which turns a single valid login into a larger incident surface.

Q: Where do identity-based networking controls usually fail in practice?

A: They fail when organisations keep legacy infrastructure in place as an exception path. If VPNs, NAT workarounds, or special routing rules remain available for convenience, the old trust model survives beside the new one and the control boundary becomes inconsistent.

Q: What should IAM teams do when service account access is broader than the workload needs?

A: IAM teams should reduce the entitlement to the minimum runtime function the workload requires and then revalidate the dependency with the technical owner. Broad service account access usually persists because teams optimise for deployment convenience, not governance. Tightening scope reduces blast radius and makes later audit and offboarding decisions far easier.

Technical breakdown

How identity-based networking changes the access model

Identity-based networking moves authorization from broad network reach to connection-level policy. Instead of placing users on an internal network and then trying to contain them with layered controls, the system evaluates who or what is requesting access, what device is in use, and whether the request matches policy. This is closer to zero trust thinking than to traditional perimeter networking. The practical effect is smaller exposed surface area and fewer implicit trust paths, which is especially relevant where human users, service accounts, and managed workloads all need different access boundaries.

Practical implication: define access at the connection edge so broad network membership no longer acts as a proxy for trust.

Why legacy VPN and remote access stacks create hidden overhead

Legacy remote access is rarely just a VPN. It usually includes load balancers, NAT traversal, endpoint exceptions, routing workarounds, and support processes that accumulate as the environment grows. Each layer creates a maintenance obligation and a failure point, so the cost of access is distributed across infrastructure and operations rather than visible in a single budget line. From an identity governance perspective, that complexity also makes policy harder to reason about because access is separated from identity context once traffic enters the network.

Practical implication: inventory the full dependency chain behind remote access, not just the front-end gateway.

How least privilege reduces blast radius in connectivity

Least privilege in networking means a user or system can only reach the specific resources required for the task. The article ties that to default deny and device-aware access, which narrows the number of reachable targets even when an identity is valid. That does not prevent compromise on its own, but it does reduce how far an attacker can move once an account or device is abused. For IAM and PAM teams, this is where network design and access governance converge.

Practical implication: pair identity checks with explicit reachability limits so compromised access cannot automatically become wide network access.

Threat narrative

Attacker objective: The objective is to use legitimate network reach to expand access and increase the damage possible from a single compromised identity or device.

1. Entry occurs through valid network access that is overly broad for the user or system’s actual job function.
2. Privilege escalation happens when the attacker can pivot beyond the intended application or host because network reach is treated as trust.
3. Impact follows when lateral movement or data access becomes easier than it should be, increasing the blast radius of a compromised identity or device.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity-based networking is really an access governance problem, not a networking feature discussion. The article’s core finding is that broad connectivity hides risk inside operational convenience. When access is tied to identity and device context at the connection layer, organisations can stop treating network reach as an entitlement that persists by default. The practitioner conclusion is that access design should be governed as tightly as privileged access.

Legacy remote access has a hidden control debt. VPNs, load balancers, NAT layers, and exception handling do not just cost money to run, they also create governance ambiguity about who can reach what and why. That ambiguity matters because IAM and zero trust programmes rely on clear policy boundaries. The practitioner conclusion is that simplification is itself a control objective when access architecture has become uninspectable.

Blast-radius control is the decisive variable when connectivity and identity converge. A valid identity with broad network reach is still a risk, even if the perimeter is “protected.” The article supports a simple principle: the tighter the connection-level policy, the less a compromised account can do. The practitioner conclusion is to measure access by reachable assets, not by whether a login succeeded.

Policy at the connection layer: this is the named concept the article sharpens. It describes the shift from network membership as trust to explicit, identity-aware authorization at the moment a session is created. The practitioner conclusion is that governance teams should treat network access as a policy enforcement point, not a transport convenience.

NHI governance becomes relevant whenever services and automation use the same access fabric as people. The article is written around employee access, but the underlying control logic also applies to service accounts and workloads that should not inherit broad network reach. The practitioner conclusion is that identity-based connectivity should be extended to machine identities wherever they can otherwise bypass least-privilege boundaries.

What this signals

Policy at the connection layer is where zero trust becomes operational. When access is enforced at session creation rather than after the user is already on the network, teams gain a cleaner way to tie identity, device context, and destination policy together. That is especially useful where remote workers, administrators, and machine identities share the same infrastructure.

For IAM leads, the practical signal is that remote access architecture and access governance can no longer be managed as separate programmes. If the network design allows broad reach first and policy second, the organisation is carrying hidden access debt that will keep showing up as support tickets, exception handling, and exposure.

The broader programme implication is that simplification can be a control strategy, not just an efficiency play. Reducing the number of access layers makes policy easier to understand, easier to audit, and easier to defend when identity boundaries are challenged.

For practitioners

• Map every remote access dependency Document VPNs, load balancers, NAT layers, routing exceptions, and support workflows so the full cost and control surface of remote access is visible.
• Enforce connection-level least privilege Require explicit policy for each session so users and systems can only reach the resources needed for the task, not the whole network.
• Separate human and machine access paths Review whether service accounts, workloads, and administrators share the same connectivity model, then restrict machine access to task-scoped destinations.

Key takeaways

• The article argues that the real problem is not connectivity itself but the operational and security cost of preserving broad network reach.
• The Forrester model cited by Tailscale reports 213% ROI, $1.2 million in present value from retiring legacy access infrastructure, and a 70% reduction in exposure to breach costs for addressable attacks.
• For IAM and zero trust teams, the practical lesson is to treat connection-level policy as a governance control that narrows blast radius and reduces access friction.

Key terms

• Identity-based networking: An access model that grants connectivity based on authenticated identity and policy rather than network location. It replaces broad perimeter trust with task-specific rules that can be applied to users, devices, and workloads across environments.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Connection-level policy: A rule set applied when a session or connection is created, rather than after traffic is already inside the network. This approach makes access decisions more immediate and easier to align with identity, device posture, and destination-specific constraints.
• Remote access sprawl: The accumulation of VPNs, load balancers, NAT layers, exceptions, and support processes around remote connectivity. It creates hidden operational cost and often weakens governance by making it harder to see which paths still confer broad trust.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps security and identity practitioners build governance that fits modern access models.